LISTING OF CLAIMS 

Please amend claim 1 and cancel claims 2-3. This listing will replace all prior version, 
and listings, of claims in the appUcation. 

1 . (Currently Amended) A method of analyzing and decrypting a malicious encryption script, 
comprising the steps of: 

classifying a malicious script encryption method into a case where a decryption function 
exists in malicious scripts and is an independent function that is not dependent on the external 
codes such as run time library, a case where a decryption function exists and is a dependent 
function that is dependent on external codes, and a case where a decryption function does not 
exist; and 

if the decryption function exists in malicious scripts and is the independent function that 
is not dependent on the external codes, extracting a call expression and a function definition for 
the independent fimction, executing or emulating the extracted call expression and function 
definition for the independent function, and obtaining a decrypted script by putting a result value 
based on the execution or emulation into an original script at which an original call expression is 
located; 

if the dependency of the decryption function on the external codes is determined based on 
whether there exists the dependency of all codes within the decryption function on the external 
codes, whether actual parameters for decryption function call in all program are constants, and 
whether only functions with no side effects in the decryption function are callediand 

if there exists the dependency of all codes within the decryption function on the external 
codes within function F j satisfies the following formula: 

Vj n E , = ^ 

where V , is a set of global variables defined as used in function F jg and is obtained 
according to the following formula: 



Vj = A j - and 

E, is a set of variables defined or used in an external region of function and is obtained 
according to the following formula: 
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where n is the number of functions defined in the script, 

F, is an i-th defined function in the script (1 < i < nl 

A| is a set of all variables defined or used in function F , (1 < i < a), 

Di is a set of all variables declared as Dim in function F ^ (1 < i < n), and 

Vn is a set of variables defined or used in a global region which does not belong to any 




function. 



Cancel Claims 2 and 3. 



